AI agent governance and audit controls for data
Coding agents, copilots and data agents now reach your warehouse, and each one arrives with its own permissions and no shared record. Data Workers puts every agent that touches data, ours or yours, under the same permissions, approvals and tamper-evident audit trail.
Before and after
| Today | With Data Workers |
|---|---|
| No list of which agents touch the warehouse | Every active agent inventoried, with what it uses |
| Each agent holds its own credentials and scope | One set of permissions, whichever agent is asking |
| Writes that depend on the agent's own caution | Every write previewed, approved by a named person and signed |
| Agent activity scattered across tool logs | One tamper-evident audit trail of every call and result |
| Agents trusted until something breaks | Health, drift and behaviour watched, with alerts |
Engineers connect a coding agent to the warehouse on a Tuesday, and by Friday nobody can say what it read or who approved what it changed. The agent governance and audit use case goes deep on the audit side; this page is the operating model across all your agents. Reviewers now ask for the same proof from an agent that they ask from a person, and what an audit trail for data agents must hold is a good checklist to hold yourself to.
How it works
1. See every agent and set what it may touch
The Observability Agent lists every active agent with list_active_agents, so the inventory is a fact, not a survey. The Data Access & Governance Agent applies your role-based access with enforce_rbac and tests each request against your rules with check_policy. Each workspace decides which tools agents may use, and the same permissions and personal-data rules apply to Data Workers agents and to coding agents such as Claude Code, Cursor and Codex.
2. Route every write to a named approver
Agents read freely, but write only through one approval path with no side door. The Data Access & Governance Agent raises each proposed change with request_governance_review, showing the full change, what it would affect and how to undo it. Irreversible changes wait for a named person, and the highest-risk ones need two different people, never the one who asked.
3. Keep the record and watch the agents
Every tool call and every approval lands in the audit trail, which the Observability Agent reads back with get_audit_trail. The same agent watches agent health and behaviour with check_agent_health and detect_drift, and the Usage Intelligence Agent shows which tools each agent actually uses with get_tool_usage_metrics. Alerts go to your owners when something is off.
The impact metrics we move
- •Inventory of every agent touching data: from about 2 weeks to 2 h
- •An agent change approved by a named person: from about a week to ~1 h
- •An agent action traced to its approver: from about a day to under 10 min
Where teams start
- •Coding agents on the warehouse. Claude Code, Cursor or Codex asking about tables and requesting changes, under your permissions.
- •Data agents that write. Pipeline fixes, schema migrations and access grants routed to named approvers.
- •Homegrown agents on MCP. Agents your team built, reading through one governed data layer.
- •Sensitive domains first. Finance, customer and HR tables, kept at watch or suggest while the record builds.
- •Agent access reviews. A quarterly look at what each agent may use and what it did.
What powers it
Governance comes with the Data-Agents Swarm: one approval path and one audit trail shared by every agent, in your own environment if you run it there. The Autonomous Data-Conductor keeps each agent inside the autonomy its domain allows, and Autopilot Standards hold every domain to the rule you set once. The Spellbook Data Catalog supplies the owners and authoritative sources that make a named approver possible. The Observability Agent, Data Access & Governance Agent and Usage Intelligence Agent do the work. For the approval mechanics, see how approvals work for AI data agents; for the risk question behind it, whether it is safe to let agents change production data.
Where this shows up: audit logging, safe agent writes to production and one governed data layer for every AI agent.
The climb: from assisted to autonomous to agentic
Every transformation runs on the same ladder from our thesis: agents first watch and suggest with receipts, then act after approval, and a domain moves up only on its own review record. L0 to L2 run today, and only a domain's owner can raise its level. L3 and L4 are where a domain can go on evidence; the autonomy levels explained lay out the scale.
The pilot
- •Scope. One data domain and the agents that touch it, ours and yours.
- •First week. Agents start by watching and suggesting. We inventory every active agent and show the approvals and audit records they would have produced.
- •By week two. Routine agent work runs through the approval path on its own schedule; anything sensitive stays with a named approver.
- •At day 30. We review the impact metrics against your baseline:
- •Inventory of every agent touching data: from about 2 weeks to 2 h
- •An agent change approved by a named person: from about a week to ~1 h
- •An agent action traced to its approver: from about a day to under 10 min
- •Cost. Start with a pilot ($7,500 one-time, credited in full against the first year). Scale is from $1,000 a month and Enterprise from $3,000 a month, billed annually, with unlimited seats, no usage meter and no markup on model spend. See pricing.
FAQ
Does it govern agents we built ourselves? Yes, when they reach data through the governed data layer: the same permissions, personal-data rules and approvals apply, whichever agent is asking.
What stays with people? Approvals for anything irreversible, the rules agents are held to, and the decision to raise a domain's autonomy.
Does the audit trail leave our environment? Not if you run Data Workers in your own environment; the records stay on your side.
What if an agent is wrong? Every write is previewed and approved first, each change shows how to undo it, and if people start reverting an agent's changes, that domain pauses itself.
Which stacks? Snowflake, Databricks and BigQuery, with dbt and Airflow, among 50+ connectors.